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AMENDMENTS TO THE DRAWINGS 

Please replace Figure 7 with the Replacement Figure 7, included herewith and labeled 
"Replacement Sheet." 
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REMARKS 

STATUS OF THE CLAIMS 

Claims I-IO, 12, 21-23, 43-45, and 48-53 were pending in this application. Claims 22 
and 23 have been amended. Following entry of the amendments claims 1-10, 12, 21-23, 43-45, 
and 48-53 will be pending and at issue. 
ALLOWABLE SUBJECT MATTER 

Applicant acknowledges the Examiner's statement that claims 43-45 would be allowable 
if rewritten in independent form to include all of the limitations of the base claim and any 
intervening claims. Office Action, p. 10. 

AMENDMENTS TO THE SPECIFICATION 

The specification has been amended to include indication of trademarks with the symbol 
"TM" or "®," where appropriate and to capitalize the trademarks. The Applicant also notes that 
the trademarks used in the application are accompanied by the generic terminology where 
appropriate, as noted by the Examiner. Office Action, p. 3. No new matter has been added. 

AMENDMENTS TO THE DRAWINGS 

The Examiner objected to Figure 7, stating that the shading of the graphic in the Figure 
makes it illegible. Office Action, p. 2. Applicant has thus included a revised drawing sheet for 
Figure 7 labeled "Replacement Sheet," in which this shading has been removed. Approval of the 
Replacement Sheet of the drawing is respectfully requested. 
IDS 

Applicant notes with appreciation the Examiner's thorough consideration of the 
references cited in the IDS (Form 1449) submitted on December 6, 2001, including the French 
Patent No. 2693809 submitted previously. Office Action, pp. 2-3. 

REJECTIONS UNDER 35 U.S.C. § 112, FIRST PARAGRAPH 

Claim 23 was rejected under 35 U.S.C. § 1 12, first paragraph as allegedly containing 

subject matter which was not described in the specification in such a way as to enable one skilled 
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in the art to which it pertains, or with which it is most nearly connected, to make and/or use the 
invention. Office Action, p. 4. Examiner stated that Applicants' specification "merely refers to 
several methods for several recovery methods that are not well-known in the art (symmetric 
correlation, asymmetric correlation, etc.) without describing the methods." Without agreeing 
with the Examiner's rejection, but in the interest of further expediting prosecution, the 
Applicants have amended claim 23 to delete the terms referred to by the Examiner. Thus, 
Applicants respectfully request withdrawal of this ground of rejection. 

REJECTIONS UNDER 35 U.S.C. § 112, SECOND PARAGRAPH 

Claim 22 was rejected under 35 U.S.C. § 1 12, second paragraph as allegedly indefinite 
because it is "incomplete for omitting essential structural cooperative relationships of elements, 
such omission amounting to a gap between the necessary structural connections." Office Action, 
p. 5. The Examiner further stated that "[n]o limitation shows how the original instruction code 
length calculation recited in the first limitation is related to the remainder of the invention." 
Without agreeing with the Examiner's rejection, but in the interest of further expediting 
prosecution, the Applicants have amended claim 22 to delete the calculating step referred to by 
the Examiner. Thus, Applicants respectfully request withdrawal of this ground of rejection 

REJECTIONS UNDER 35 U.S.C. § 103 

Claims 1-4, 6-10, 12, and 21-23 are rejected under 35 U.S.C. § 103(a) as allegedly being 
unpatentable over WIPO Patent Publication No. 99/01815 to CoUberg et al. in view of U.S. 
Patent No. 6,829,710 to Venkatesan et al. Applicant traverses this ground of rejection. 

Three requirements must be met for a prima facie case of obviousness. First, the prior art 
references must teach all the limitations of the claims. Second, there must be a motivation to 
modify the reference or combine the teachings to produce the claimed invention. Third, a 
reasonable expectation of success is required. 

The cited prior art references do not teach all of the elements of the claims. The 
combination of CoUberg and Venkatesan does not disclose the randomly generated, functionally 
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isomorphic code being "generated by random selection from a plurality of candidate codes/' as 
recited in claims 1 and 10. The Examiner admitted that "Collberg does not disclose the random 
selection from a set of isomorphic codes." Office Action p. 6. However, the Examiner stated 
that "Venkatesan discloses the random selection of functions from a library in the process of 
protecting (watermarking by obfriscation) code." Id. The Applicants respectfully disagree and 
find that nowhere does Venkatesan discuss random selection of functions from a library. Rather 
Venkatesan "randomly selects pairs of nodes, . .and also inserts a pre-defined routine. . .from 
library 330" (emphasis added). Venkatesan, col. 7, lines 26-34. These pairs of nodes that 
appear on a flow graph created in Venkatesan correspond to regions of the target code where a 
pre-defined routine will be inserted. See Id, Thus, Venkatesan describes, at most, randomly 
selecting locations where a predefined routine can be inserted, not randomly selecting a routine 
to be inserted from a plurality of candidate routines. While the pre-defined routine is from a 
library, there is no random selection of it from that library. See Id, Thus, Venkatesan does not 
disclose random selection of code from a plurality of candidate codes, as recited in claims 1 and 
10. 

In addition, claims 1 and 10 recite a step of "scanning said compiled code for candidate 
instructions for substitution," and a step of "substituting randomly generated, functionally 
isomorphic code in place of said candidate instructions." The section of Collberg cited by the 
Examiner only discloses a technique of reordering the placement of items in the source 
application, but does not describe a step of scanning compiled code to find candidate instructions 
and then substituting the candidate instructions for randomly generated, fimctionally isomorphic 
code. The randomization in Collberg applies to randomizing of placement rather than the 
random generation of functionally isomorphic code described in the present application, which is 
substituted in for the candidate instructions. Similarly, the second section of Collberg cited by 
the Examiner (p. 68, line 14 to p. 69, line 9) only discloses randomization of the order of 
computations to be performed in obfiiscation or randomizing the order of declarations used in the 
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source application. Venkatesan does not remedy this deficiency as Venkatesan also fails to 
disclose the scanning and substitution steps. 

Similarly, Venkatesan does not disclose "substituting random context instruction codes 
for original CPU instructions in said compiled code" or "correlating said random context 
instruction codes to said original CPU instructions," as recited in claims 12, and 21, for at least 
the same reasons as stated above. In fact, Venkatesan does not disclose random context 
instruction codes at all, but at most discusses random selection of pairs of nodes in a flow graph. 
Again, the selection of the pre-defmed routine to be inserted in the target program in Venkatesan 
is not random. 

Accordingly, for at least. the reasons stated above, the cited references do not teach all of 
the elements of claims 1 and 10. Claims 2-4 and 6-9 depend from claim 1 and incorporate all of 
the elements of claim 1, while claims 22-23 depend from claim 21 and incorporate all of the 
elements of claim 21 . Thus, dependent claims 2-4, 6-9, and 22-23 cannot be rendered obvious by 
the cited combination at least for the reasons described above. 

The cited art does not teach or provide a motivation to combine the teachings. The 
Examiner stated that "Collberg takes complied code and obfuscates. . .it in a random manner 
when possible." Office Action, p. 6. Venkatesan, however, does not disclose obfuscating the 
code of the target application. Venkatesan merely addresses the hiding of a watermark or 
subprogram within the target application so that the target application can be readily identified. 
There is no suggestion in Collberg to modify his obfuscation techniques to include a watermark 
in the target program for identification of the target program, nor is there any suggestion in 
Collberg to include a step of random selection of pairs of nodes in a flow graph. The Examiner 
must show "reasons that the skilled artisan, confronted with the same problem as the inventor, 
and with no knowledge of the claimed invention, would select the elements from the cited prior 
art reference for combination in the manner claimed." In re Rouffet, 47 USPQ2d at 1458, 1453 
(Fed. Cir. 1998). Thus, the motivation to combine must be particularized, and the required 
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evidence cannot be substituted with a generalized scientific goal. Accordingly, the cited art does 
not teach or provide a motivation to combine the teachings, and thus the cited art cannot render 
obvious the claims. 

Claims 1 and 5 are rejected under 35 U.S.C. § 103(a) as allegedly being unpatentable over 
U.S. Patent No. 5,696,822 to Nachenberg in view of U.S. Patent No. 6,829,710 to Venkatesan et 
al. Applicant traverses this ground of rejection. 

The cited prior art references do not teach all of the elements of the claims. The 
combination of Nachenberg and Venkatesan does not disclose the randomly generated, 
functionally isomorphic code being "generated by random selection from a plurality of candidate 
codes," as recited in claim 1 . The Examiner admitted that "Nachenberg does not disclose the 
random selection from a set of isomorphic codes." Office Action p. 7. However, the Examiner 
stated that "Venkatesan discloses the random selection of functions from a library in the process 
of protecting (watermarking by obfuscation) code." Id, As explained above, Venkatesan 
discloses random selection of nodes and not random selection of functions from a library, and 
thus Venkatesan does not disclose random selection of code from a plurality of candidate codes. 

In addition, Nachenberg does not describe the step of "scanning said compiled code for 
substitution," as recited in claim 1 . The Examiner pointed to a brief description in Nachenberg 
(col. 1, lines 1 1-17) of polymorphic viruses and generally how they work. Office Action at p. 7. 
Nachenberg simply refers to a mutation engine that "generates a virus decryption routine" and 
then "uses the dual of this routine to encrypt the static virus body and the mutation engine." 
Nachenberg, col. I, lines 20-23. There is no explanation of how this encryption occurs. There are 
various mechanisms by which the polymorphic virus might work to generate the virus decryption 
routine, and thus one carmot assume that there would be any step involving scaiming compiled 
code for specific candidate instructions to be substituted. Similarly, Nachenberg does not 
describe a step of substituting code in place of the candidate instructions for which the scarming 
was performed. Nachenberg only vaguely refers to some mutation strategies, but does not 
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actually describe the specific substitution step, as recited in claim 1 , where randomly generated, 
functionally isomorphic code is substituted in place of the candidate instructions to generate a 
first code polymorph. Venkatesan does not remedy this deficiency, as explained above. 

Accordingly, the Applicants respectfully submit that the combination of references cited 
fails to teach each and every element of claim 1 . Since claim 5 depends from and incorporates 
all of the elements of claim 1, claim 5 also cannot be rendered obvious by the cited references. 

The cited art does not teach or provide a motivation to combine the teachings. The 
Examiner states that "Nachenberg discloses that a polymorphic virus. . .provides each new file 
with a mutated (obfuscated) version of the virus, as this fioistrates most standard virus-detection 
schemes." Office Action, p. 7. Again, Venkatesan, however, does not disclose obfuscating the 
code of the target application, but merely addresses the hiding of a watermark or other signature 
within the target application so that the target application can be readily identified. Accordingly, 
the cited art does not teach or provide a motivation to combine the teachings, and thus the cited 
art cannot render obvious the claims. 

Claims 48, 49, and 51-53 are rejected under 35 U.S.C. § 103(a) as allegedly being 
unpatentable over U.S. Patent No. 6,006,328 to Drake further in view of U.S. Patent No. 
6,829,710 to Venkatesan et al. 

The cited prior art references do not teach all of the elements of the claims. The 
combination of Drake and Venkatesan does not disclose the randomly generated, functionally 
isomorphic code being "generated by random selection from a plurality of candidate codes," as 
recited in claims 48 and 53. The Examiner admitted that "Drake does not disclose the use of 
random algorithms." Office Action p. 8. However, the Examiner stated that "Venkatesan 
discloses the random selection of functions from a library in the process of protecting 
(watermarking by obfuscation) code." Id. As explained above, Venkatesan discloses random 
selection of nodes and not random selection of functions from a library, and thus Venkatesan 
does not disclose random selection of code from a plurality of candidate codes. 
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In addition, claims 48 and 53 recite a step of "substituting randomly generated, 
functionally isomorphic code in place of said candidate instructions." The Examiner stated that 
Drake discloses "insertion of obfuscating code, which is isomorphic, in appropriate places," and 
the Examiner noted that "[sjcanning the code is necessary to determine such places." Office 
Action at p. 9. However, the section of Drake cited by the Examiner describes usage of 
"obfuscating inserts" and states that "[ojbfuscation is achieved by following unconditional jump 
instructions. . .with one or more dummy op-code bytes which will cause subsequent op-codes to 
be erroneously disassembled." Drake at col. 5, lines 42-54. Drake does not disclose substitution 
of candidate instructions for randomly generated, functionally isomorphic code. The section in 
Drake cited by the Examiner does not refer to any random generation of code. Venkatesan does 
not remedy this deficiency, as described above. 

Accordingly, for at least the reasons stated above, the cited references do not teach all of 
the elements of claims 48 and 53, Claims 49, 51, and 52 depend from claim 48 and incorporate 
all of the elements of claim 48. Thus, claims 49, 51, and 52 carmot be rendered obvious by the 
cited combination at least for the reasons described above. 

The cited art does not teach or provide a motivation to combine the teachings. The 
Examiner states that "Drake discloses the insertion of obfuscating code, which is isomorphic, in 
appropriate places." Office Action, p. 8. As described above, Venkatesan, however, does not 
disclose obfuscating the code of the target application, but merely addresses the hiding of a 
watermark or subprogram within the target application so that the target application can be 
readily identified. There is no suggestion in Drake to modify his obfuscation techniques to 
include a watermark in the target program for identification of the target program. Accordingly, 
the cited art does not teach or provide a motivation to combine the teachings, and thus the cited 
art cannot render obvious the claims. 

Claim 50 is rejected under 35 U.S.C. § 103(a) as allegedly being unpatentable over U.S. 
Patent No. 6,006,328 to Drake in view of U.S. Patent No. 6,829,710 to Venkatesan et al. as 
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applied to claim 48 further in view of U.S. Patent No. 5,966,450 to Hosford et al. Applicant 
traverses this ground of rejection. Claim 50 depends from claim 48 and incorporates all of the 
elements of claim 48. Thus, claim 50 cannot be rendered obvious by the cited combination at 
least for the reasons described above regarding why claim 48 is not rendered obvious by Drake in 
view of Venkatesan. Hosford does not remedy the deficiencies of Drake and Venkatesan. 

In conclusion, the cited references do not disclose all the limitations of the claims, and 
there is no motivation to combine the references as suggested by the Examiner. Accordingly, a 
prima facie case of obviousness has not been presented by the Office. Therefore, withdrawal of 
this ground of rejection of claims 1-10, 12, 21-23, and 48-53 is respectfully requested. 
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CONCLUSION 



Withdrawal of the pending rejections and reconsideration of the claims are respectfully 



requested, and a notice of allowance is earnestly solicited. If the Examiner has any questions 



concerning this Response, the Examiner is invited to telephone ApplicEint's representative at 



(650)335-7185. 



Respectfully submitted, 
DAVID TUCKER, ET AL. 



Antonia L. Sequeira, Esq. 
Reg. No.: 54,670 
Fenwick & West LLP 
SiHcon Valley Center 
801 California Street 
Mountain View, CA 94041 
Tel.: (650)335-7185 
Fax.: (650) 938-5200 



Dated: 
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